Agent Build Club Privacy Policy

1. About this policy

This policy explains how Commsarc Limited, trading as Agent Build Club (“ABC”, “we”, “us”, “our”), collects, uses and protects personal information. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It applies to everything we do: our website, events, online lecture series, courses, hackathons, employability clinics, community spaces and the innovation programmes we deliver with partner organisations. It is the same for every programme and every partner.

Our privacy information comes in three layers, so you only need to read the part that affects you.

Where a programme notice gives more detail for that programme, the programme notice applies to it. No programme notice reduces your rights under this policy.

2. Who we are

Commsarc Limited trades as Agent Build Club. We are registered in England and Wales under company number 13038985, and our registered office is at 248 St Helier Avenue, Morden, London SM4 6JZ. We are registered with the Information Commissioner’s Office under registration number ZC250286.

We are the controller of the personal information described in this policy. We are an independent controller with our own obligations. When we run a programme with a partner, such as a university, each organisation is a separate controller of its own processing. We are never a joint controller with a partner, and we never process personal information as a partner’s processor or subcontractor. Each organisation decides for itself how it uses the information it holds, is responsible for that use, and answers to you for it.

Our data protection contact is Michael Kohn, Director. You can reach him at privacy@agentbuild.club or by post at our registered office. We are not required to appoint a Data Protection Officer under Article 37 of the UK GDPR and have not done so.

3. The information we collect

What we collect depends on how you deal with us.

What we do not collect

• We do not collect special category information, such as information about health, ethnicity, religion, sexual orientation or political views, under Article 9 of the UK GDPR.
• We do not collect information about criminal convictions or offences under Article 10 of the UK GDPR.
• We do not collect financial account information from the people who use our website or take part in our activities.
• We do not collect information about anyone’s private life.
• Our activities are for adults. We do not knowingly collect information about anyone under 18.

If you volunteer special category information in a free text field, we do not use it, and we remove it where we reasonably can.

4. Where we get it from

• From you, when you fill in a form, register, join our community, take part in an interview, write to us or come to an event.
• From your use of our website, through cookies and similar technologies, where you allow them.
• From a colleague, where someone at your organisation registers you for an event or names you as a contact.
• From public professional sources, such as an organisation’s website or a professional profile, when we approach organisations about working with us.

We do not receive lists of students, staff, members or registrants from programme partners.

5. Why we use it and our lawful bases

We use personal information only where the law gives us a basis to do so.

We do not rely on public task. We are a private company, not a public authority.

Some of our forms ask you to tick a box to confirm that you have read the relevant notice. That tick records that you were given the notice. It is an acknowledgement, not a consent, and we do not rely on it as a lawful basis.

Consent is always separate and optional. Marketing, photography, filming and recording each have their own unticked box, they are never bundled with registration, and saying no never affects whether you can take part. You can withdraw any consent at any time by contacting us or using the unsubscribe link in our emails. Withdrawing does not affect anything we did before you withdrew.

6. Programmes we run with partners

Some of our programmes are delivered with partner organisations, such as universities, and some are supported by public funders. The partner for each programme is named on that programme’s pages and forms, and in its programme notice.

Which information belongs to a programme

Only information collected through programme-branded forms, pages and spaces belongs to that programme. Everything else we collect sits outside it and is covered by this policy alone.

Separate controllers, in sequence

We control our own processing. The partner controls its own. Information reaches a partner only in the way described below, and from that point the partner holds it as its own controller, under its own privacy notice.

We introduce, we do not share lists

We do not send programme partners lists of registrations, periodically or at all. Instead:

1. You register your interest with us, on our forms and under our notice. We are the only controller of that registration.
2. We ask you in writing whether you would like us to forward your details and introduce you to the partner’s programme manager.
3. Only if you say yes, and we have recorded that answer, do we send one email introducing you, with you copied in.
4. The partner then collects anything else it needs directly from you, as its own controller.
5. Later, we ask you whether the introduction led to a match. If it did not, we can help you approach other institutions.

We follow three rules every time. We ask in writing and record your answer, with the date and the wording we used. We introduce one business at a time and never in batches. We copy you in, so you see exactly what was sent.

If you say no to an introduction, that has no effect on anything else we offer you.

An introduction email carries your name, role, contact details, organisation and a structured summary of your registration. It never carries the raw transcript or recording of an interview.

An introduction gives a partner no exclusivity, no right of first refusal and no restriction on our working with your business elsewhere.

No student information, in either direction

We do not receive information about students from universities, and we do not give universities information about how any student engages with us. We are not a party to any dissertation or teaching contract, we take no part in teaching, supervision or marking, and we do not need student information to deliver our programmes.

Reporting is aggregate only

We report engagement to programme partners and funders as numbers: totals, attendance, attendance rates and counts of registrations. We may count registrations by organisation email domain, for example the number of registrations from one company’s domain. A count is not personal information, and we take two precautions to keep it that way:

• We suppress or band any figure below five.
• We never publish a breakdown by email domain that would identify a sole trader, because a domain with a count of one can identify a person. We report by sector and size band instead.

7. Our community spaces

Our community spaces are an open, professional-facing environment for knowledge exchange. Students are welcome on the same terms as everyone else.

• We are the only controller of the community spaces and everything in them.
• Joining is voluntary. It is never a condition of taking part in anything else we offer.
• We do not report on anyone. We do not tell a programme partner, university, employer or anyone else whether you joined, what you posted or how often you visited. Any figures we publish about the spaces are aggregate and identify nobody.
• The spaces are not a learning environment. They are not used to assess anyone and form no part of any academic record. Universities run their own virtual learning environments, and our community spaces are not one of them.
• The spaces run on a third party platform. The platform’s own terms and privacy notice apply to you as a member alongside ours. The provider is listed on our data processors page.

8. Events, recordings and photography

Registers

Where an event forms part of a programme we run with a partner, each organisation keeps its own register, under its own notice. We never exchange attendee lists with a partner. We do not use a sign-in sheet that both organisations use, we do not use a registration form that both organisations can see, and we do not compare our register with a partner’s to see who attended both.

Photography, filming and recording

We only photograph, film or record you in a way that identifies you if you have given your consent through a separate, unticked box. Saying no never affects whether you can attend. At in-person events we make it easy to stay out of shot. At online sessions we tell you at the start if a session is being recorded, and you can keep your camera off.

We sometimes turn photographs from our events into line drawings for our website and materials. We only use photographs of people who consented to photography, and we do not use them to train AI models.

If you withdraw your consent, we will not use your image in anything new, and we will remove it from places we control where we reasonably can. We cannot recall material that has already been printed or distributed.

9. Interviews and AI assisted research

The optional interview in our forms

Some of our registration forms offer an optional interview, run by an AI feature of our forms platform, to help us understand your registration.

• It is always optional. Declining has no effect on how your registration is treated.
• Text is the default. Audio is offered. Video is not enabled. If we ever enable video, we will update this policy and the relevant programme notice first.
• A person reviews the result. The interview never decides on its own whether a registration goes forward.
• Where we make an introduction, the partner receives the structured summary of your registration, never the raw transcript or recording.
• We keep interview transcripts and recordings until the end of the programme or for 12 months, whichever is sooner.
• We do not use what you say to train AI models, and we require the same of our providers.

Our research

From time to time we invite people to take part in research about how work and entrepreneurship are changing. Taking part is optional. We publish findings in aggregate, and we will only quote you by name if you give us permission to.

10. Who we share with and international transfers

We share personal information only as follows:

• Our processors, the providers that run our website, forms, community spaces and other services on our behalf, under contracts that meet Article 28 of the UK GDPR. They are listed on our data processors page.
• Programme partners, only through an introduction you have asked for in writing (section 6), and otherwise only as aggregate figures that identify nobody.
• Funders, only as aggregate figures that identify nobody.
• Professional advisers and auditors, including a funder’s appointed auditors where a grant agreement requires access to our records, under a duty of confidentiality.
• Regulators, law enforcement and courts, where the law requires us to.
• A buyer or successor, if our business or part of it is sold or reorganised, under the same protections as this policy.

We never sell personal information, and we never share it with advertisers or sponsors.

Some of our providers process information outside the UK. Where they do, we rely on UK adequacy regulations where they apply. Otherwise we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Our data processors page shows the position for each provider.

11. Marketing

We send newsletters and marketing emails only to people who have given their consent through a separate, unticked box. It is never a condition of registering for anything. Every email has an unsubscribe link, and you can also ask us to stop at any time. We do not share our mailing lists with partners, sponsors or anyone else.

12. How long we keep information

We keep personal information only for as long as we need it for the purpose we collected it for.

A programme notice may set a different period for that programme, and if it does, the programme notice applies.

13. How we protect it

We limit access to personal information to the people who need it to do their work. We use strong authentication on our accounts, our providers encrypt information in transit, and every processor works under a contract that requires appropriate security. We review our arrangements regularly.

If a personal data breach happens, we will report it to the Information Commissioner’s Office within 72 hours where the law requires, and we will tell you without undue delay if it is likely to put your rights and freedoms at high risk.

14. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to erase your information;
• ask us to restrict how we use your information;
• ask for information you gave us in a portable format;
• object to our using your information on the basis of legitimate interests, which includes our programme processing; and
• object at any time to direct marketing, in which case we will stop.

Where we rely on your consent, you can withdraw it at any time.

To use any of these rights, contact privacy@agentbuild.club. There is no charge. We will respond within one month, and we may need to confirm your identity first. Some rights are subject to legal limits, and if one applies we will explain it.

If you object to our programme processing, we will stop unless we have compelling legitimate grounds to continue. In practice, we will withdraw your registration.

If we have introduced you to a programme partner and you ask us to correct or erase your information, we will tell that partner, as the law requires. The partner holds what it received as its own controller and decides for itself what to do with it, so you may also want to contact the partner directly. Its contact details are in the programme notice.

15. Automated decision making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you, so Article 22 of the UK GDPR is not engaged. The optional interview in our forms is always reviewed by a person, and it never decides on its own whether a registration goes forward.

16. Cookies

Our website uses cookies and similar technologies. Those that are strictly necessary for the site to work are always on. All others, including analytics, are used only if you allow them through our cookie settings, and you can change your choice at any time. Our cookies notice at /cookies explains which cookies we use and why.

17. Complaints

If you are unhappy with how we have handled your personal information, please tell us first at privacy@agentbuild.club so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113.

18. Changes and version history

We review this policy regularly. When we change it, we publish the new revision here with its effective date and record what changed below.